Emby

18 CVEs across 4 Emby products. Browse Emby vulnerabilities, severities, and proof-of-concept exploits.

Emby products with known CVEs

ProductCVEs
Emby6
Mediabrowser6
Emby.releases3
Windows3
Emby CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-64113Critical9.82025-12-09Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby S…
CVE-2025-64325Critical9.02025-11-18Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request wi…
CVE-2025-46391Medium6.52025-08-06CWE-284: Improper Access Control
CVE-2025-46390High7.52025-08-06CWE-204: Observable Response Discrepancy
CVE-2025-46389Medium6.52025-08-06CWE-620: Unverified Password Change
CVE-2025-46388Medium4.32025-08-06CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CVE-2025-46387High8.82025-08-06CWE-639 Authorization Bypass Through User-Controlled Key
CVE-2025-46386High8.82025-08-06CWE-639 Authorization Bypass Through User-Controlled Key
CVE-2025-46385High8.62025-07-20CWE-918 Server-Side Request Forgery (SSRF)
CVE-2025-46384High8.82025-07-20CWE-434 Unrestricted Upload of File with Dangerous Type
CVE-2025-46383Medium6.12025-07-20CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
CVE-2023-4167Low3.52023-08-05A vulnerability was found in Media Browser Emby Server 4.7.13.0 and classified as problematic. This issue affects some unknown processing of the file /web/. Th…
CVE-2021-25828Medium6.12023-06-28Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web.
CVE-2021-25827Critical9.82023-06-28Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address.
CVE-2023-33193Critical9.12023-05-30Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewin…
CVE-2022-36223Medium6.12022-12-16In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the…
CVE-2021-32833High8.62021-09-09Emby Server is a personal media server with apps on many devices. In Emby Server on Windows there is a set of arbitrary file read vulnerabilities. This vulnera…
CVE-2020-26948Critical9.82020-10-10Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.